Facets
Monthly
Cross-site scripting in the Drupal Facets contributed module allows unauthenticated remote attackers to inject script into faceted-search output on sites running Facets before 2.0.10 (0.x/2.x branches) or before 3.0.1 (3.x branch). Exploitation is not automatic: it requires a victim to interact with attacker-supplied content - for instance clicking a crafted link or loading a page containing injected facet markup - after which script runs in the victim's browser context and can read or alter limited page data. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and EPSS is very low at 0.19% (8th percentile), consistent with a moderate-severity (CVSS 6.1) issue of low urgency rather than an emergency patch item.
Missing authorization in the Drupal Facets contributed module lets unauthenticated remote attackers bypass access controls and directly request facet endpoints to view content that was intended to be restricted (forceful browsing). All Facets releases before 2.0.10 and 3.0.x releases before 3.0.1 are affected, and the impact is limited to the information those exposed facets reveal rather than full data or system compromise. A vendor patch is available (2.0.10 / 3.0.1), EPSS is low at 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).0.0 before 2.0.9. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting in the Drupal Facets contributed module allows unauthenticated remote attackers to inject script into faceted-search output on sites running Facets before 2.0.10 (0.x/2.x branches) or before 3.0.1 (3.x branch). Exploitation is not automatic: it requires a victim to interact with attacker-supplied content - for instance clicking a crafted link or loading a page containing injected facet markup - after which script runs in the victim's browser context and can read or alter limited page data. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and EPSS is very low at 0.19% (8th percentile), consistent with a moderate-severity (CVSS 6.1) issue of low urgency rather than an emergency patch item.
Missing authorization in the Drupal Facets contributed module lets unauthenticated remote attackers bypass access controls and directly request facet endpoints to view content that was intended to be restricted (forceful browsing). All Facets releases before 2.0.10 and 3.0.x releases before 3.0.1 are affected, and the impact is limited to the information those exposed facets reveal rather than full data or system compromise. A vendor patch is available (2.0.10 / 3.0.1), EPSS is low at 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).0.0 before 2.0.9. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.